Posted
by
samzenpuson Monday June 30, 2014 @01:39PM
from the who's-to-blame dept.

tsu doh nimh writes In a move that may wind up helping spammers, Microsoft is blaming a new Canadian anti-spam law for the company's recent decision to stop sending regular emails about security updates for its Windows operating system and other Microsoft software. Some anti-spam experts who worked very closely on Canada's Anti-Spam Law (CASL) say they are baffled by Microsoft's response to a law which has been almost a decade in the making. Indeed, an exception in the law says it does not apply to commercial electronic messages that solely provide "warranty information, product recall information or safety or security information about a product, goods or a service that the person to whom the message is sent uses, has used or has purchased." Several people have observed that Microsoft likely is using the law as a convenient excuse for dumping an expensive delivery channel.

I can't imagine Microsoft has to pay Microsoft for Microsoft products. Accounting may want them to move the money around, but that's stupid and pointless because it doesn't actually cost them money to give it to themselves.

I can't imagine Microsoft has to pay Microsoft for Microsoft products. Accounting may want them to move the money around, but that's stupid and pointless because it doesn't actually cost them money to give it to themselves.

If the cost license doesn't get you, then the compute cycles, ram allocations, and administrators' salaries will.../troll

You really have no idea how budgeting, and accounting and divisions and tax laws and outsourcing works. Got it. Now, for the rest of us, on the triplicate recieving end of notifications that we aren't going to patch till the weekend, this is still slightly good news. Breaking a stick off in some lawmaker while shrugging your shoulders is just funny.

sure it would... the salary of the people doing the work to move money around and account for it.

A few months ago I put a request into the company I work for asking for a $20 piece of software (against policy to buy it and install it myself, gotta go through the process...)

Looking at the process, it would have cost thousands in employee time to document, review and approve the purchase of the $20 piece of software at all the different levels of management involved in it. it's insanely wasteful.

Er, no. The original version of DOS was developed by Seattle Computer Products; later versions contained contributions from IBM and Microsoft. Microsoft Windows was Microsoft's baby all along, though it certainly got ideas if not code from OS/2 which was jointly developed by IBM and Microsoft.

Email requires bandwidth, and you can't distribute it through a CDN like you can with downloads. It's cheap for spammers because they anonymize their email, but security notifications say they come from microsoft.com. Now consider that you have BILLIONS of emails to send. That can get costly.

Email requires bandwidth, and you can't distribute it through a CDN like you can with downloads. It's cheap for spammers because they anonymize their email, but security notifications say they come from microsoft.com. Now consider that you have BILLIONS of emails to send. That can get costly.

Why can't you distribute it via a CDN, exactly? I mean someone like Microsoft has either direct control over, or actually runs their own CDN servers: firing up a SMTP service (to route mail based on proximity to destination MX) should be the easy part.

There are tons of e-mail sending services. I'm not sure how you define a "CDN" but they essentially serve that role. Companies like SendGrid have hundreds of hosts across multiple datacenters that are dedicated to relaying email for their clients.

Combine this with the fact that they have all of the email infrastructure in place already to support message delivery for Hotmail and Exchange Online, and it does literally cost them almost nothing to deliver these messages which are a tiny drop in a huge ocean of mail they deal with.
I'm inclined to think that email cost has anything to do with it.

Are your email addresses hosted with services like hotmail, gmail, or managed by competent admins who use services like spamtitan or mailcleaner? It's very likely you're seeing the results of a large number of people working very hard to keep the spam you receive away from your inbox...

You can even setup a cronjob or a windows task to open the website on a regular basis if you are extra forgetful or lazy.

Of all the things to bitch about with respect to Microsoft...

Because, you know, the typical small businesses are overflowing with IT-wizard-like employees who are masters at using these things, and hold the process in high enough regard to keep an eye peeled for patches.

Because, you know, the typical small businesses are overflowing with IT-wizard-like employees who are masters at using these things, and hold the process in high enough regard to keep an eye peeled for patches.

A business that can't be bothered to keep competent IT most likely has automatic updates turned on, even for their servers, thus the e-mails to them would be redundant. Businesses with competent and dedicated IT people are most likely using WSUS, which provides its own mechanism to get e-mails about newly available updates, as well as total control over when and where they're installed.

OK, what's the real reason for this? It's obviously not the law, and it's obviously not the cost associated with sending out e-mail - if you think ASCII e-mail is a bloated bandwidth hog, you should try watching the average HTTP transaction.

So, here's my conjecture: they are initiating a corporate policy of phasing out e-mail in favour of... something with more lock-in. Just like they wanted to show that they were so hip-against-the-desktop and in favour of walled garden app stoers that they tried to phase

RSS and other HTTP documents can be cached on a proxy at the border. Mail can't so easily, especially with spam filters breaking large Bcc lists. If you prefer mail, write a proxy that polls RSS feeds and sends mail when one changes.

I was referring to "The general principle that [...] delivery SMTP servers SHOULD NOT, perform validation tests on message headers". Plenty of spam filters rely on message headers. What do you think DomainKeys Identified Mail is?

Limiting number of RCPT TO lines is a fucking awful way to handle spam, and explicitly discouraged by RFC 2821:

All that says is that you should not reject the message based on the number of recipients. You can, however, temporarily reject (using a 4xx status code) recipients after some set number. Any good MTA will retry the tempfails.

I currently have a variation of this in place where any e-mail to a "special" address (like postmaster or webmaster) can't have any other recipients at my mail server. Right now, it's a log-only rule, and hasn't been triggered very often, but I wanted to make sure I don't reject or

The average game lasts three minutes, three games a day. That's about 10 minutes lost productivity a day. 200 days a year that's 2000 minutes, or 34 hours a year. That's an entire work-week (FR) spent playing solitaire, each year. Blame it on the rain? Canada? No! Blame Microsoft!

for the windows crowd: Unix Linux and BSD sending and receiving an email is pretty mundane business (even to millions of people.) Sendmail begat postfix, which tidied up the nuts and bolts of SMTP in the land of penguins neckbeards and that cartoon blowfish you occasionally see.

sending email from Exchange is orders of magnitude more complex by the nature of Exchange as a monolithic communications product. Because exchange does scheduling, calendaring, contacts, unified messaging, failover management, automatic load balancing, remote configuration management, archival, database storage, advanced RBAC permission delegation and cool stuff like shadow redundancy, outlook servers themselves have become increasingly divorced from the RFC for the SMTP. It isnt a bad thing for businesses that rely on being constantly connected, but it does mean the simple act of sending an email means relying on what for us would be an OS in itself. Exchange 2013 requires 2 gigabytes of free disk and recommends 16 gigabytes of free RAM. To compare and contrast, many in the BSD community can handle millions of messages per day with 2 gigabytes of ram and 1 gigabyte of free disk. that includes storage for the message being sent.
I think microsoft is doing this because exchange wasnt designed to just "send an email" anymore. it expects interactivity, redundancy, and universal access to the information being sent by default. the *nix solution runs hard and fast, but as an SMTP implementation requires significantly more engineering to provide the same level of service and feature set as outlook.

Why on earth would they use Exchange to do such a task? Exchange is a product aimed at corporate users, not customers. They would just use some flavor of their SMTP service and a program of some sort (Perl. Perl fixes everything.) to pump the messages into it.

Also, no matter how many sendmail servers you have you can't get around the fact that egress still takes bandwitdth. And they are working at a little higher scale than the "watch me nerd out more than you" listserv.

Also, no matter how many sendmail servers you have you can't get around the fact that egress still takes bandwitdth.

I just got a large, image-filled email from a vendor, and it came out to 20KB (including headers). Let's assume Microsoft's announcement emails are that huge, and that Microsoft sends out 100,000,000 of them. Let's further assume that Outlook is smart enough to batch recipients to the same domain with a conservative 10-to-1 reduction in number of unique messages sent (probably closer to 500-1, given the number of Gmail users you can collapse). That math works out to about 1000 gigabit ethernet seconds, or a

Using RSS instead of Twitter allows Microsoft not to rely on the single point of failure that is Twitter Inc.

And besides, isn't this solved by Windows Update?

For one thing, having thousands of PCs in a company individually download multi-megabytes updates from Windows Update wastes the bandwidth compared to use of WSUS. For another, some administrators prefer to test Windows patches before deploying them because Windows patches some are known to break programs that inadvertently rely on underspecified behavior.

Canadian IT head here. Just spent the morning reading over the law that this is in knee-jerk reaction to. I think Microsoft's reaction is warranted. According to the new law, a company can be charged up to 10 Million dollars for an infraction (read single email) of un-solicited email. The law is poorly formed, and not well thought out, as well as lengthy and vague enough to create a broad swatch of culpable people.

What it boils down to is this. If you send an un-solicited email to someone you have not done business with in the last 2 years, and they have not opted in before and, and they believe your email to be spam, boom, you are culpable. Also if you install software on someone's computer without explicit, but easy to understand examples of what the software is/does you can also be held culpable.

All email a company produces in Canada form this point on have to include a link in the bottom or ability to opt out of all future email.

Canadian businesses, no matter how small, are beholden to this law. Small companies are going to fold left and right because they cannot afford to comply wiht the new regulations, and those that don't try to comply run the risk of paying a huge penalty.

In my personal opinion this is a grab at trying to make Canada Post relevant again (and financially viable). At the moment bulk mail is the only thing keeping Canada post afloat, and if you couldn't send an email to try to drum up business, you can always send a mailer...

While anti-spam law is well intentioned, in it's current form it is so broken it should not have seen the light of day.

The summary makes me want to laugh and cry at the same time. So the people who wrote the law don't think there are any costs of compliance? I'm sure that's not news. That right there is a HUGE problem with government solutions.

Nope, neither I nor my company send the spam. No I wasn't on the CASL. Just trying to give a perspective from someone in the IT field who's clients are about to have to change their business practices, not just the spammers but ALL business using email as a point of contact with their clients AT ALL. So as an IT person in Canada who does contract work with small businesses my load is about to significantly increase, and my clients profitability (regardless of whether they use email to self promote) is ab

I am not saying the goal of reducing spam is bad, in fact I agree an opt in system would make more sense, but unfortunately businesses have had this law sprung upon them, with little warning, and the penalties for infraction are huge

The law was enacted in 2010. In fact, it was proposed back in 2009.

I know, 4 years is "not enough time" I mean, Microsoft has been telling people XP's support would end in April 2014 for years now and everyone STILL got caught off guard.

interesting take on things, and i can see why they would be concerned. a 10 million dollar fine for a single email? if they are sending tens of thousands of them out, even 1 goes to the wrong address and bam. thanks for the insight, wish i had mod points

What it boils down to is this. If you send an un-solicited email to someone you have not done business with in the last 2 years, and they have not opted in before and, and they believe your email to be spam, boom, you are culpable.

Good! That is the definition of spam. Spammers should die.

And this Canadian law is completely irrelevant to most mailing lists.

To get on a mailing list, you have to submit your email address, then they send a confirmation message, then you have to click the link in the email to co

Thats the thing. Microsoft did not have implied consent. Thats was this announcement means. They likely have no record of who consented to be on this mailing list. I bet they simply have a list of of email addresses in a db somewhere. When you ask to be on the list they add you and then delete the email. When you ask off they remove you and delete the email. If they want to do an maililng list they have to start from scratch and keep better records.

If they want to do an maililng list they have to start from scratch and keep better records.

Flat out wrong.

Microsoft could just send an email to everyone asking them to click to confirm that they still want to receive the messages. Microsoft could have been doing this in the emails they sent over the last several months.

The LISTSERV (http://en.wikipedia.org/wiki/LISTSERV) email list software package has had this feature for more than a decade. It would be trivial for Microsoft to do this if they wanted to.

"Upto" is the key wording. Remember this is the key point in case law, especially for setting abuse precedents. And it's sure not going to cause small companies to fold left and right. If it does, the business is already doing something wrong, and thriving off of bulk spam in the first place. What this is, is an extension of the DNC, and since we're moving in a direction of tossing mail to the wind--especially with companies now charging between $1 to $8 for a bill to be physically mailed, I'm sure you

What it boils down to is this. If you send an un-solicited email to someone you have not done business with in the last 2 years, and they have not opted in before and, and they believe your email to be spam, boom, you are culpable.

Easy solution: don't email people that you don't have reasonable proof that they explicitly opted in sometime in the previous 2 years. I can't think of too many situations where a 2+ year old lead would be valuable from a marketing standpoint without a more recent business relatio

That is exactly what Microsoft has done. They likely have poor records for this massive list. The list also no longer serves a marketing purpose as they can't include advertisements for services and still be exempt. So they canned it. RSS was the cheapest replacement.

They could have easily complied with the law by sending out a non-advertisement security-related email saying that if they wished to remain on the mailing list they would need to explicitly "opt-in" to the list again, (re)confirming their desire to receive the emails. At that time they could either specify that the newly reconfirmed opt-in list might receive security AND/OR advertisements, or make the list security only without plugging any of their products/services.

I think that is what they have done. They sent out an email with instructions on how to get the security updates. The method they are using, RSS, gives you control over how you recieve those updates. With the new approach microsoft isn't keeping track of your email address or personal information. They are not using some propietarty bs either. RSS is a standard supported by lots of companies.

"Canadian businesses, no matter how small, are beholden to this law. Small companies are going to fold left and right because they cannot afford to comply wiht the new regulations, and those that don't try to comply run the risk of paying a huge penalty."

You're an idiot. I have been getting email's all month from like every vendor I have ever dealt with, every company, with an email saying "hey there, please stay in contact with us". So it's hardly killing businesses left and right as you claim. Or even is

Canadian IT head here. Just spent the morning reading over the law that this is in knee-jerk reaction to. I think Microsoft's reaction is warranted. According to the new law, a company can be charged up to 10 Million dollars for an infraction (read single email) of un-solicited email. The law is poorly formed, and not well thought out, as well as lengthy and vague enough to create a broad swatch of culpable people.

What it boils down to is this. If you send an un-solicited email to someone you have not done

This law or not, any recurring e-mails are spammy. E-mail should be reserved for one time interactions like order confirmations and of course personal communication. With RSS feeds, user can unsubscribe, suspend and resume viewing updates at their convenience.

RSS is just markup. A simple rss feed is just a an xml document you host like a web page that contains a list of items. Each item having a title, description and pubDate with rss as the root of the document.

Why is it better to have to maintain a whole separate infrastructure of servers, protocols, and clients, when basic email does the job just fine? I can unsubscribe, suspend, and resume at my convenience now, I don't see why we would need another delivery channel. You could just as well say that interested parties should just go to the website when they want to know something.

With RSS feeds, user can unsubscribe, suspend and resume viewing updates at their convenience.

With email subscriptions, users can unsubscribe, suspend, and resume viewing updates at their convenience. Email is also vastly more bandwidth and power friendly than continually polling to ask "have anything for me yet? have anything for me yet? have anything for me yet?".

An email newsletter that a user can subscribe to and which honors the "unsubscribe" link it at the bottom is identically as spammy as RSS.

MS's emails may not be exempt, for example a security notice for an XP security hole suggesting users to upgrade from XP to windows 8, even if it's only a time component of the email, would not be exempt, and they could face a $10 million fine. Per email. Furthermore, the onus is 100% of MS to have documented proof they had consent to send the email if they are charged.

The law is horrible, how many spam emails are actually coming from Canadian companies? Less then 1%? It will be legitimate businesses th

The Canada Anti Spam Law requires very specific opt in from the people recieving emails. It requires that certian content not be in the email. It has fines. Microsoft is going to have to train its people and change its templates. It is going to have to get its emails approved by Canadian lawyers. It will take time for it to get in complience of the law. But the deadline is tommorow. So they will RSS feeds instead. It is very easy for an expert to say the emails are exsempt to the press. But I bet if you showed them a few emails they would find a few problems. Things Microsoft needs to fix or get fined.

Or maybe this is Microsoft admitting that they, as a corporation, are simply incapable of passing up an opportunity to shove advertising down people's throats, largely because they have no desire to do so.

I automated this a while ago, using Powershell to query the RSS feed, pull out the details, and send the proper parties an email if there's a new message relevant to us.

It probably seems like reinventing the wheel, but allowed us to split out the emails to relevant for each group, rather than one monolithic email. Which meant each affected party was liable to actually read it.

Overall though, anything that shows how useful RSS is, is a good thing.

RSS is the right way. Distributions lists for notifications of this type have been done with mail historically because it was there not because it was a good medium.

Consider if you use e-mail for this sort of thing you need to take care of several functions e-mail does not itself take care of:*allow people to subscript*allow people to unsubscribe*scrub you mailing lists for dead addresses.

Your mail servers might be stuck with large disk queues waiting on dead domains where the MX server does not answer etc

How easily people forget and get in to a comfort zone. When Microsoft first announced switching to a patch Tuesday email, everybody on/. criticized them for waiting up to a week to announce 0-day vulnerabilities and patch information.

A once a week email is close to worthless. It's better to leave vulnerability notification to people who are serious about it and stop wasting Internet bandwidth, cycles. and storage.

Just another victim of the issues around bandwidth and cost to do perform the updates.

With Net Neutrality no longer being upheld, Microsoft's patching and update process is very expensive. Can it even be done with a server onsite getting patched first and updates to the rest of a businesses client machines coming from it? If so, then even that did not help at the multi-national conglomerate I worked at. A huge Java dev cloud user env, the Administrators performing updates to thousands of machines were

I should know better than to feed the trolls....but I just don't get this "Happy Monday from The Golden Girls" thing.
I've seen it a few times on various articles (maybe not always "Happy Monday"). I guess I could Google it, but that seems like a lot of work for something as unimportant as this.
*shrug*